In The Current Issue:– Model railway company Hornby takes classic hobby brands into digital age– Banker’s startup experience feathers the nest for Starling Bank– Should businesses upgrade to Windows 10?
Download Current Issue

Security experts
have long considered Telnet a security risk because user names, passwords and all subsequent commands are transmitted as easily-exploitable plaintext. A new zero-day flaw in Sun Microsystems' Solaris 10 and 11 operating systems illustrates the threat.

According to several security organizations, a serious design error has been exposed in the Solaris 10-11 Telnet daemon that allows for unauthenticated remote root logins.

"This vulnerability can be exploited by using standard Telnet commands, further increasing the severity of this exposure," Cupertino, Calif.-based antivirus giant Symantec Corp. warned in an emailed message to customers of its DeepSight threat management service. "An exploit for this issue was released without an associated advisory and therefore it is believed that it has been exploited in the wild prior to the release."

The French Security Incident Response Team (FrSIRT) has rated the problem high-risk, describing it as an error in the Telnet daemon (in.telnetd) that fails to properly validate authentication information before being passed to the login process.

The Telnet protocol allows virtual network terminals to be connected over the Internet and is incorporated into a variety of popular operating systems, from Sun Solaris and Red Hat Enterprise Linux to Apple's Mac OS X.

Donald Smith, a volunteer handler at the Bethesda, Md.-based SANS Internet Storm Center (ISC), said this latest flaw should serve as a reminder that Telnet is not secure.

0 comments

E-Mail

Username / Password

Password

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy